[Android Software/Hacking General [Developers Only]] Doc_cheilvenerdi.org:
[Hack] Root Phones ("exploit needless" method)

How I root any ROM on (almost?) any Android Phone

My Phone simply needs to fullfill one requirement:

I MUST be able to flash the recovery.img standalone!

Chapter One: unpack, edit and repack recovery.img

I will use these Linux programs:

split bootimg (Thanks to William Enck)

mkbootimg (compiled from AOSP source)

...the former splits the recovery.img into kernel and ramdisk...

...the latter repack all togheteher...

...For example I'll try these commands on a clockworkmod recovery from an HTC desire (I download 5.0.2.0-bravo from ClockWorkMod)...

Linux Side:

doc@gandalf $ split_bootimg.pl recovery-clockwork-5.0.2.0-bravo.img
Page size: 2048 (0x00000800)
Kernel size: 1831224 (0x001bf138)
Ramdisk size: 1291948 (0x0013b6ac)
Second size: 0 (0x00000000)
Board name:
Command line: no_console_suspend=1 msmsdcc_sdioirq=1 wire.search_count=5
Writing recovery-clockwork-5.0.2.0-bravo.img-kernel ... complete.
Writing recovery-clockwork-5.0.2.0-bravo.img-ramdisk.gz ... complete.
doc@gandalf $

I write down parameters needed later on:

Page Size = 2048

Command line = 'no_console_suspend=1 msmsdcc_sdioirq=1 wire.search_count=5'

HexEditing Lookout of recovery.img header:

doc@gandalf $ hexedit recovery-clockwork-5.0.2.0-bravo.img

00000000 41 4E 44 52 4F 49 44 21 38 F1 1B 00 00 80 00 20 ANDROID!8......
00000010 AC B6 13 00 00 00 00 21 00 00 00 00 00 00 F0 20 .......!.......
00000020 00 01 [COLOR=#0000ff][B]00[/B][/COLOR] [COLOR=red][B]20[/B][/COLOR] 00 08 00 00 00 00 00 00 00 00 00 00 ... ............
00000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000040 6E 6F 5F 63 6F 6E 73 6F 6C 65 5F 73 75 73 70 65 no_console_suspe
00000050 6E 64 3D 31 20 6D 73 6D 73 64 63 63 5F 73 64 69 nd=1 msmsdcc_sdi
00000060 6F 69 72 71 3D 31 20 77 69 72 65 2E 73 65 61 72 oirq=1 wire.sear
00000070 63 68 5F 63 6F 75 6E 74 3D 35 00 00 00 00 00 00 ch_count=5......

I use the highlighted address ordered as follows:

base = 0x20000000

Now I simply repack alltoghether.. just to check new file vs old one:

doc@gandalf $ mkbootimg --kernel recovery-clockwork-5.0.2.0-bravo.img-kernel --ramdisk recovery-clockwork-5.0.2.0-bravo.img-ramdisk.gz --base 0x20000000 --pagesize 2048 --cmdline 'no_console_suspend=1 msmsdcc_sdioirq=1 wire.search_count=5' -o recovery_new.img
doc@gandalf $
doc@gandalf $ diff recovery-clockwork-5.0.2.0-bravo.img recovery_new.img
doc@gandalf $

No warnings, binary files don't differ...

Editing ramdisk:

doc@gandalf $ mkdir ramdisk
doc@gandalf $ cd ramdisk/
doc@gandalf $ gunzip -c ../recovery-clockwork-5.0.2.0-bravo.img-ramdisk.gz | cpio -i
4294 blocks
doc@gandalf $ ls -l
totale 144
drwxrwx--x 2 doc doc 4096 23 nov 23.56 data
-rw-r--r-- 1 doc doc 2615 23 nov 23.56 [B]default.prop[/B]
drwxr-xr-x 2 doc doc 4096 23 nov 23.56 dev
drwxr-xr-x 2 doc doc 4096 23 nov 23.56 etc
-rwxr-x--- 1 doc doc 94372 23 nov 23.56 init
-rwxr-x--- 1 doc doc 691 23 nov 23.56 init.rc
drwxr-xr-x 2 doc doc 4096 23 nov 23.56 proc
drwxr-xr-x 3 doc doc 4096 23 nov 23.56 res
drwxr-x--- 2 doc doc 4096 23 nov 23.56 sbin
drwxr-xr-x 2 doc doc 4096 23 nov 23.56 sys
drwxr-xr-x 3 doc doc 4096 23 nov 23.56 system
drwxr-xr-x 2 doc doc 4096 23 nov 23.56 tmp
-rw-r--r-- 1 doc doc 0 23 nov 23.56 ueventd.goldfish.rc
-rw-r--r-- 1 doc doc 4027 23 nov 23.56 ueventd.rc
doc@gandalf $

I'm going to modify one line of default.prop from

...
ro.secure=[B]1[/B]
...

to

...
ro.secure=[B]0[/B]
...

WARNING: clockworkmod recoveries could already have ro.secure set to 0

Repack ramdisk:

doc@gandalf $ find . | cpio -o -H newc | gzip > ../recovery-clockwork-5.0.2.0-bravo.img-ramdisk.gz
4295 blocks
doc@gandalf $ cd ..
doc@gandalf $

Repack recovery.img (as showed before):

doc@gandalf $ mkbootimg --kernel recovery-clockwork-5.0.2.0-bravo.img-kernel --ramdisk recovery-clockwork-5.0.2.0-bravo.img-ramdisk.gz --base 0x20000000 --pagesize 2048 --cmdline 'no_console_suspend=1 msmsdcc_sdioirq=1 wire.search_count=5' -o recovery_new.img
doc@gandalf $

Chapter Two: flash recovery.img to phone

I own a Samsung Galaxy Next, so I need to create an Odin Ready Archive and so on...

Different phone brands need different flash methods, I bet...

Chapter Three: Rooting

I need android sdk and I try android debug bridge...

...on a not rooted phone:

(i686) doc@gandalf $ adb shell
[B]$[/B] su
Permission denied
[B]$[/B]

...and on a rooted one:

(i686) doc@gandalf $ adb shell
[B]$[/B] su
[B]#[/B]

Now, starting the phone in recovewry mode with ro.secure=0, connecting with "adb shell" I find:

doc@gandalf $ adb shell
#

Already a root shell! No exploit needed!

Take a look to /system:

# mount
...
/dev/block/mmcblk0p3 /system ext4 [B]rw[/B],relatime,barrier=1,data=ordered 0 0
...

WOW! already "read-write" mounted... (if not mounted I can easily remount it "rw"... I'm root!)

Now, having su binary, Superuser.apk and busybox in the linux working directory:

Linux side:

doc@gandalf $ adb push su /system/xbin
417 KB/s (22228 bytes in 0.051s)
doc@gandalf $ adb push su /system/bin
529 KB/s (22228 bytes in 0.041s)
doc@gandalf $ adb push busybox /system/xbin
5061 KB/s (1674712 bytes in 0.323s)
doc@gandalf $

Anyway it should be better to make a backup of old su binary before overwriting it (adb pull /system/bin/su su-old)

"adb shell":

# chown root.shell /system/bin/su
# chmod 06755 /system/bin/su
# chown root.shell /system/xbin/su
# chmod 06755 /system/xbin/su
# chmod 04755 /system/xbin/busybox
#

WARNINNG: ordered commands

Linux:

doc@gandalf $ adb push com.noshufou.android.su-1.apk /system/app/Superuser.apk
5198 KB/s (843503 bytes in 0.158s)
doc@gandalf $

"adb shell":

# chmod 644 /system/app/Superuser.apk
#

THAT'S ALL FOLKS!​

reboot system now!

...

doc@gandalf $ adb shell
$ su
#

Enjoy!

...no exploit needed...

...

...Simply Linux Way of Hacking!...